Identifier detector
Swiss ZSR/RCC billing number: format, validation and detection
Short answer
A Swiss ZSR (RCC) number is one letter from A to Y followed by six digits, where the digits weighted 6 to 1 give the letter's alphabet position modulo 26. Maskflare masks it only after a keyword such as ZSR, RCC or K-Nummer.
What it is
The ZSR number (French: RCC) identifies a billing party in Swiss health insurance, kept in the register run by SASIS. Maskflare files it as a health ID in the Switzerland pack, and the Swiss nDSG health profile includes it. It appears in invoices, tariff exports and provider lists.
In Maskflare this is the detector ch_zsr, labelled "Switzerland - ZSR/RCC billing number", category health id number, in the Switzerland pack.
Format and layout
- One letter from A to Y, then six digits, for example D123456. The pattern also accepts a space after the letter and a dot before the last two digits.
- The letter is the check character: it encodes a number derived from the digits.
How the check works
Multiply the six digits by 6, 5, 4, 3, 2 and 1 and add the products. The remainder after dividing the sum by 26 must equal the letter's position in the alphabet, with A as 1. The validator follows the CH Core zsr-check-digit definition referenced in its source.
Worked example
- Digits 1 2 3 4 5 6 with weights 6 5 4 3 2 1 give 6, 10, 12, 12, 10, 6.
- The total is 56, and 56 divided by 26 leaves 4.
- Position 4 in the alphabet is D, the letter of the example.
Valid and invalid examples
| Example | Result | Why |
|---|---|---|
D123456 | Valid | Matches the layout and passes the validator. |
D123450 | Invalid | The invalid example changes one character, the last character: 6 becomes 0. |
In running text the valid example reads, for instance, ZSR-Nr. D123456. The invalid one is left alone: a value that fails the validator is treated as an ordinary string.
Regex and validation caveats
- The shape is a letter plus six digits, which is plain enough to need a keyword. The detector therefore requires one before the value, from a list that includes the German, French and Italian names for the number.
- Only the letters A to Y are accepted, because the check yields a position from 1 to 25.
- The check proves the form, not that the number is in the SASIS register.
Words that confirm it
The detector masks a match only when one of its keywords appears within 48 characters before the value. The catalogue lists 12: k-nummer, no rcc, numero rcc, numéro rcc, n° rcc, rcc, zahlstellennummer, zahlstellenregister, zsr, zsr nr, zsr nummer, zsr-nr.
How to detect it in LLM traffic
Swiss ZSR/RCC billing number values appear in referral letters, lab reports, claims exports, appointment lists and clinical notes. When a clinician or administrator asks an assistant to summarise or rewrite such a document, the identifier goes with the text even though the task does not need it.
Maskflare scans the whole request, replaces each match with a token and, with response restoration on, puts the real value back into the answer for the person who is allowed to see it. Health identifiers sit in the Healthcare (PHI) pack, which is on in the default template without a country choice.
If you build the detection yourself
- Strip spaces, dots and hyphens before running any arithmetic, but remember where they were so the original text can be replaced exactly.
- Match the shape with a pattern anchored on word boundaries, so that a long digit string is not read as several shorter Swiss ZSR/RCC billing number candidates.
- Run the check from the section above. A failing check is almost always a typo or a made-up value; a passing one removes most look-alikes.
- Require one of the words listed above shortly before the value. Maskflare looks back 48 characters.
- Replace the value before the text is sent anywhere, and keep a mapping if the answer has to be restored afterwards.
How Maskflare handles it
- Protect now, Finance - Protect now, Healthcare and Developer: mask (a reversible token) when Switzerland is a primary country.
- Monitor first: alert (counted, forwarded unchanged) when Switzerland is a primary country.
The available actions are mask (reversible token), redact, partial, hash, format-preserving encryption, generalize, alert and block. Masked values are kept encrypted for 30 days so that answers can be restored, then they expire; prompts and responses are not logged. The full list of detectors is in the detector reference.
Compliance profiles that include it
One compliance profile includes the Switzerland pack, and applying it turns this detector on: Switzerland - nDSG health data. A profile is a floor: it never turns anything off or weakens a rule that is already stricter.
Frequently asked questions
Which words trigger the ZSR detector?
The catalogue lists a dozen, including zsr, rcc, no rcc, numéro rcc, n° rcc and k-nummer, in the languages used in Swiss billing documents.
Does the letter have to be capitalised?
The validator reads the first character in upper case, so a lower-case letter is checked the same way.
Is the Swiss ZSR/RCC billing number detector on by default?
It depends on the organisation's primary countries. It is part of the Switzerland pack, which the default Protect now template turns on with the action mask when Switzerland is a primary country.
Does a valid Swiss ZSR/RCC billing number prove the person exists?
No. A check digit shows the value is well formed. Many valid-looking numbers have never been issued, and Maskflare masks them all the same.
Rules on this page describe what Maskflare's detectors and validators check. They are read from the detection catalogue and are not the specification of the body that issues the identifier. Examples are synthetic.